Domain User Account Restriction

[AceDace]

What group policies (or other means) are available to lockdown domain user accounts so that a local user account is not automatically created when domain users logon to a workstation?

My goal is to create an environment where domain users only have write access to their own profile.

Windows 2003 Server and XP Workstations

 

[djtech2k]

I do not understand your question. When a domain user logs onto a workstation, it creates a profile for that user, but does not create a local account as you mentioned. By default, a Domain user should have write permissions to its own profile and not have any write permissions to other profiles unless it is granted local administrative control.